I have a complex distributed environment, I'll try to stick to the root of my concerns. Basically I have site 1 and site 2. Site 2 just forwards directly to site 1 now via a forwarder. However I would like to have site 2 forward to a site 2 indexer.
The problem I see, I will be forwarding site 2 index to site 1 index (I won't go into details, it is what needs to be done). What happens if site 2 index sends the exact same data as site 1 index is already getting? I imagine there will be a slight overlap with some of the logs during this transition, however I worry about the implications of this duplicity.